Event ID 4722: A user account was enabled
Written when a disabled account is enabled, including newly created accounts.
- Log
- Security
- Category
- Account management
Why it matters
- Re-enabling an old, disabled account (such as a leaver or the built-in Guest) is a quiet way to get access.
What to check
Check which account was enabled, by whom, and whether it had been disabled for a long time.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1098 Account Manipulation
- T1078 Valid Accounts